Do Organisations using third-party processes have to be PCI compliant?
The Payment Card Industry Data Security Standard (PCI DSS) contains requirements aimed at helping protect cardholder data. PCI DSS requirement 12.8 requires vendors to manage third-party service providers to protect their customers’ card data effectively.
Is PCI compliance required?
Yes, PCI compliance is required for all businesses that accept credit or debit card payments — even for businesses with very little volume. Note that while PCI compliance is required for all businesses, until January 2017, validation of that compliance is not necessarily required for all business types.
Can a analytics provider be a PCI service provider?
There is no specific PCI requirement about having 3rd party Javascript on your site or not. Personally, I would not consider an analytics provider to be a PCI Service Provider under PCI DSS.
Is it possible to achieve Level 2 PCI compliance?
If an e-commerce site is looking for level 1 or level 2 PCI DSS compliance (and therefore needs to involve a QSA as part of the SAQ review or ROC full audit) and the marketing department are asking for third party analytics javascript tags to be inserted onto every page, will this necessarily make PCI compliance almost impossible to achieve?
What to look for in a non PCI security test?
During a normal, non PCI security test, this would usually be worded that there is a third party library present and this risk should be reviewed to ensure that the library is trusted, and the domain it is hosted on is also trusted, should this is an external domain.
Do you have to trust third party tracking code?
In essence, you would have to completely take on trust the effectiveness of the third party tracking code, and all the security controls and testing etc. surrounding their code changes because you have little or no control over the script (s) that are pulled in to your website.